[Yattaze]

This is the continuation / rebrand of the ZeroCool Botnet.

Sales Open

So some of you may remember ZeroCool, the bot I was coding awhile back
now. during the time between me being largely inactive and now I've been held up
with the real world and looking back too the old codebase with new eyes... well it wasn't
good, there was no structure and it looked like it had been thrown together by someone
who thought they knew what they were doing. (Which isn't far from the truth). So, I did
endless amounts of research, combing through leaked sources and other projects, reading
blogs and generally improving my knowledge on the subject... And here we are now, I've spent
the last few weeks planning out and starting a new bot, with a new name.

Please note this is not a sales thread, and there are no vouch copies or anything along those lines,
thought I would get that out of the way as it seemed to be a common question.

Specific Planned Features:

1. Panel:
   • New Custom Design [DONE]
     
   
   
   • Built in bot shop [DONE]    
     
   
   
   • RC4 Encrypted Communication
     
   
   
   
   


2. Bot:
   • [TASK] Download & Execute [DONE]
     
   
   
   • [TASK] Update [DONE]
     
   
   
   • [TASK] Uninstall [DONE]
     
   
   
   • Usermode Rootkit [DONE]
     
   
   
   • RC4 Encryption Library [DONE]
     
   
   
   • Debug / Analysis Prevention
     
   
   
   • Builtin TOR Support
     
   
   
   • Domain Generation Algorithm [DONE]
     
   
   
   
   

Panel Pictures:
Index:
Spoiler (Click to View)


Clients:
Spoiler (Click to View)


Tasks:
Spoiler (Click to View)


Store Backend:
Spoiler (Click to View)


Logs:
Spoiler (Click to View)

[Friedrich Nietzsche]

Builtin TOR Support
Domain Generation Algorithm

Why would you have both of these though?

[Yattaze]

Why would you have both of these though?

Ones only available if the other is disabled, so you can't have tor and dga
only one or the other

[MrPatterson]

This looks absolutely epic, great work - are you planning on doing a beta, paid or otherwise?

[Yattaze]

This looks absolutely epic, great work  - are you planning on doing a beta, paid or otherwise?

I am looking into private pre-release testing where 5-10 trusted people can test stability,
bugs, security etc so I can correct potential issues before I officially sell it.

[INML]

Oh nice, its beautiful, epic !

[ᵠᴀ̲̅narchistᵠ]

I can be one of the testers. Which language?

[inyourmemory]

Same, what is this written in?

[IzzyMichiel]

Hey,

Looking awesome!

Good luck,
IzzyMichiel

[DeletedUser999213]

I would love to work with you on this, please consider it

[05317832892]

If you want a silly DGA idea, something I thought of a couple days ago, maybe use Trump's first tweet of the current week as a seed for your DGA.

Very unpredictable, but a bit of a race condition against security researchers though.

In regards to your "Usermode Rootkit", is this hiding the process or hooking for terminate/open handle?

Good luck with development.

[Nenny]

I would love to work with you on this, please consider it

damn this looks amazing, good luck and would love to see updates on the status of this, if you need any help let me know. Also i hella vouch for TH3FR3D he is a good coder and would love to see some of his code with this aswell.
Keep up the good work!
:D

[Yattaze]

I can be one of the testers. Which language?

Same, what is this written in?

I would love to work with you on this, please consider it

If you want a silly DGA idea, something I thought of a couple days ago, maybe use Trump's first tweet of the current week as a seed for your DGA.

Very unpredictable, but a bit of a race condition against security researchers though.

In regards to your "Usermode Rootkit", is this hiding the process or hooking for terminate/open handle?

Good luck with development.

Thank you all for the interest and I will look into testers when its closer to a releasable state.
In regards to the language, the bot is written in C++11, with a custom CRT and the rootkit is
C++11 Both statically linked supporting XP Sp1 upwards and currently, the rootkit is hiding
the process and any dropped files, I'm also looking into hiding any registry keys it will use

[05317832892]

Thank you all for the interest and I will look into testers when its closer to a releasable state.
In regards to the language, the bot is written in C++11, with a custom CRT and the rootkit is
C++11 Both statically linked supporting XP Sp1 upwards and currently, the rootkit is hiding
the process and any dropped files, I'm also looking into hiding any registry keys it will use

ZwCreateFile
NtOpenFile
ZwQueryDirectoryFile
NtEnumerateValueKey
RtlGetNativeSystemInformation
NtSetValueKey
ZwDeleteValueKey
ZwQueryValueKey
NtOpenProcess

Those are the ones hooked my kronos, they will do the job well.

[Yattaze]

ZwCreateFile
NtOpenFile
ZwQueryDirectoryFile
NtEnumerateValueKey
RtlGetNativeSystemInformation
NtSetValueKey
ZwDeleteValueKey
ZwQueryValueKey
NtOpenProcess

Those are the ones hooked my kronos, they will do the job well.

Thanks for this, it'll add them to my Todo list and do my research